Privacy
battuta collects no data. No telemetry, no analytics, no crash reporting, no accounts, no sign-in, no licence check, no update ping. The application makes no network requests of its own — not on first run, not ever. Nothing you open, edit, play or save leaves your machine.
There is no server to send anything to: battuta — on the desktop, on iPhone and iPad, and on Android — reads and writes MEI files on your own device, and nobody — including the maintainer — can see what you are working on.
What the app stores
Section titled “What the app stores”Everything battuta keeps lives on your own computer, and you can delete all of it without losing a score.
| What | Where | Why |
|---|---|---|
| Your scores | Wherever you saved them | They are ordinary .mei files; battuta never copies them elsewhere |
| Open tabs and caret position | battuta.session.v1 in local storage |
Session restore — reopens what you had open, by path |
| Editor settings | battuta.settings.v1 |
Layout, zoom, playback and input options |
| Keymap changes | battuta.keymap.v1.<layout> |
Only the bindings you rebound; defaults are not stored |
The session entry holds file paths and names — not the contents of your scores. Clearing your browser data (web build) or the app’s local storage (desktop) resets all three; your files on disk are untouched.
On iPhone, iPad and Android
Section titled “On iPhone, iPad and Android”The phone and tablet apps keep the same promise, with what a phone adds:
| What | Where | Why |
|---|---|---|
| Your scores | battuta’s own folder (in the Files app on iPhone and iPad), or a folder you picked | Where save puts a new score; the folder view lists it |
| Folders you picked | iOS: a bookmark in the app’s own settings; Android: the system’s grant | So the folder view reopens them next time — removed with the app |
- Bluetooth is used only to connect a MIDI instrument you choose — through Apple’s Bluetooth MIDI view on iPhone and iPad, through a scan for Bluetooth MIDI devices on Android. Android 8 to 11 ask for the location permission before any Bluetooth scan; battuta never reads your location, and Android 12 and later do not ask for it.
- Files leave the app only when you send them: the share sheet, or a copy you save somewhere yourself.
- No network. Verovio, the piano samples and the fonts ship inside the app. The Android app declares the internet permission because the framework’s template does; nothing in battuta uses it.
- The App Store’s privacy label reads Data Not Collected, and Google Play’s data safety section No data collected and No data shared.
Deleting the app deletes everything it stored — battuta’s own folder included, on iPhone, iPad and Android alike: move the scores you want to keep somewhere else first. Scores in a folder you picked stay where they are.
MIDI and audio
Section titled “MIDI and audio”A connected MIDI keyboard is read locally: battuta asks the operating system for the device list, shows the names in the status bar, and receives the notes you play. Playback goes to the built-in piano or to the output device you choose. None of it is recorded, and none of it is transmitted anywhere. In a browser, Web MIDI asks your permission first — declining it costs you MIDI input and nothing else.
Opening and saving files
Section titled “Opening and saving files”The desktop app uses your platform’s native file dialogs and touches only the file you pick. In the browser build, open file… reads the file inside the page and saving produces an ordinary download — files are never uploaded; there is nowhere for them to be uploaded to.
This website
Section titled “This website”The guide and the web editor are static files on GitHub Pages. They set no cookies, run no analytics, and load nothing from a third party — fonts are served from this site, and the search index runs in your browser, so what you type into search never goes anywhere either. Your light/dark choice is remembered in local storage, by your browser.
Like any web server, GitHub’s logs the requests it serves (IP address, time, user agent) under GitHub’s privacy statement. The same applies when you download a release, install from the apt repository, or use Homebrew or winget: those services see the request, the project does not.
Verifying all of this
Section titled “Verifying all of this”The claims above are checkable, which is the point of shipping source:
- The desktop shell has no HTTP client at all — see
src-tauri/Cargo.toml; its dependencies are the webview, file dialogs, MIDI and JSON. - There is no updater plugin configured, so nothing calls home to check for versions.
- Run the app offline, or watch it with a network monitor: it stays silent.
How those binaries are built and signed is a separate promise, kept on the code signing policy page.